CVE-2026-124916

PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted debugcookiename or debugcookievalue that is written without sufficient escaping into a PH...

CVE-2026-124916

PrestaShop contains an authenticated PHP code injection vulnerability within the back-office Performance debug-mode configuration . The root cause is that the application fails to adequately escape or sanitize user-controlled values for debug_cookie_name and debug_cookie_value before writing them...

CVE-2026-124916 PrestaShop Performance Debug Configuration PHP Code Injection

PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted debugcookiename or debugcookievalue that is written without sufficient escaping into a PH...

EUVD-2026-120080

PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted debugcookiename or debugcookievalue that is written without sufficient escaping into a PH...

CVE-2026-115252

The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the...

CVE-2026-115252 Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option

The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the...

CVE-2026-115252 Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option

The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the...

CVE-2026-115252

The Confection WordPress Cable WordPress plugin (versions 0.4.0 to 0.4.7 ) is vulnerable to unauthenticated Remote Code Execution (RCE) . The vulnerability occurs because the plugin fails to perform necessary capability or nonce checks before saving settings. Specifically, it writes one of these ...

EUVD-2026-119932

The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the...

PT-2026-140429

PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted debug cookie name or debug cookie value that is written without sufficient escaping into ...

PT-2026-140329

Name of the Vulnerable Software and Affected Versions Confection WordPress Cable versions 0.4.0 through 0.4.7 Description The plugin fails to perform capability or nonce checks before saving settings. This allows unauthenticated users to send POST requests that write unmodified, attacker-controll...

PrestaShop debug mode configuration allows PHP code injection

Overview PrestaShop's back-office Performance Debug mode functionality contains a PHP code injection vulnerability. An authenticated attacker with permission to modify debug-mode configuration can submit crafted cookie configuration values that are written into an executable PHP configuration fil...

CVE-2026-124916: PrestaShop: PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode…

PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted debugcookiename or debugcookievalue that is written without sufficient escaping into a PH...

CVE-2026-115252: Unknown Confection WordPress Cable: The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks…

The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the...

CVE-2026-36239

CVE-2026-36239 CVE-2026-36239: Authenticated RCE in PbootCMS v3.2.12 backend sitecopyright Vulnerability Overview: A critical remote code execution RCE vulnerability has been identified in the sitecopyright functionality of the PbootCMS backend administration interface. Specifically, untrusted...

RCE_CVE-2024-7954-

RCECVE-2024-7954- The porteplume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request. CRITICAL Exploit: POST...

CVE-2026-119616 Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name

The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptinfieldsfirstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execut...

CVE-2026-119616 Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name

The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptinfieldsfirstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execut...

CVE-2026-87964

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the feedConfigCustom2 parameter — only wpunslash is...

CVE-2026-87964 Product Feed Manager for WooCommerce <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection via eval() via 'feedConfigCustom2' Parameter

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the feedConfigCustom2 parameter — only wpunslash is...